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ABSTRACT 

We consider two remote parties connected to a relay by two quantum channels. To generate a secret key, they 
transmit coherent states to the relay, where the states are subject to a continuous-variable (CV) Bell detection. 
We study the ideal case where Alice’s channel is lossless, i.e., the relay is locally situated in her lab and the Bell 
detection is performed with unit efficiency. This configuration allows us to explore the optimal performances 
achievable by CV measurement-device-independent quantum key distribution. This corresponds to the limit 
of a trusted local relay, where the detection loss can be re-scaled. Our theoretical analysis is confirmed by an 
experimental simulation where 10“"^ secret bits per use can potentially be distributed at 170km assuming ideal 
reconciliation. 


1. INTRODUCTION 

Quantum key distribution (QKDpi^is a central area in quantum information science.!^® A typical QKD protocol 
involves two parties, Alice and Bob, who generate secret keys by exchanging quantum systems over an insecure 
communication channel. Another scenario involves a swapping-like protocol where secret correlations are estab¬ 
lished by the measurement of a third untrusted party (relay). This idea of ‘measurement-device independence’ 
(MDI)PiSl 

has been extended to continuous-variable (CV) systems,with the possibility of much higher key 

rates. 

In this paper, we study consider a limit configuration for CV-MDI-QKD, where the relay is in Alice’s lab 
and performs an ideal Bell detection. This is an extrapolation which allows us to investigate the maximal 
rate/distance performances achievable by CV-MDI-QKD. Experimentally, this is equivalent to consider a local 
relay where the loss associated with the various technical imperfections (such as the detector inefficiencies) can 
be re-scaled and therefore neglected. As a matter of fact, this limit case corresponds to the case where the loss 
of the relay is trusted. 

Our theoretical analysis, confirmed by an experimental simulation, shows that 10“^ secret bits per relay use 
can be distributed at lOdB loss in Bob’s channel, equivalent to 50km of standard optical fibre (at the loss rate 
of 0.2dB/km). Assuming ideal reconciliation, a potential rate of about 10“^ secret bits per relay use can be 
distributed over a very lossy link, i.e., 34dB loss corresponding to 170km of fibre. 

2. PROTOCOL 

The scheme is depicted in Fig. [TJ At one side, Alice prepares a mode A in a coherent state |a) with Gaussian- 
modulated amplitude a; at the other side. Bob prepares mode B in another coherent state |/3) with Gaussian- 
modulated amplitude j3 (Gaussian distributions have zero mean and large variance). Modes A and B are sent 
to the relay, which performs a CV Bell detection,!^ by mixing the modes in a balanced beam splitter whose 
output ports are conjugately homodyned with outputs and The complex variable 7 := [q- -\- ip+)l\f2 is 
then communicated to Alice and Bob via a classical public channel. Since 7 ~ a — /3*, each party may infer the 
variable of the other party by postprocessing. 
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The most general eavesdropping strategy is a joint attack involving both the relay and the two linksfi^li^ 
Here we consider the simple case where Eve attacks Bob’s link B only, by means of a Gaussian attacl^i^ which 
introduces loss and thermal noise. The travelling mode B is mixed with an ancillary mode E by a beam splitter 
with transmissivity r. The ancilla introduces thermal noise with variance uj and belongs to a reservoir of ancillas 
under Eve’s control. This kind of entangling-cloner attaclP is repeated for each use of the relay and the output 
ancillas are finally detected by Eve by means of an optimized collective quantum measurement. 


3. SECRET-KEY RATE 

By specializing the formulas of CV-MDI-QKD,E^ we can derive the secret-key rate for the scenario depicted in 
Fig. [21 Assuming ideal reconciliation efficiency and large modulation, the key rate is given by 
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and X is the equivalent noise, decomposable as x = xioss + £, where xioss = 2(1 + t)/t is the noise due to loss, 
while e is the ‘excess noise’. The maximum theoretical performance of the protocol, with respect to the loss 
present in Bob’s link, is reached for e = 0. In this case, we have 


Rioss = h[{2 - t)/t] + log2[r/(l - T)e], 


(3) 


which goes to zero only for r —>■ 0, corresponding to Bob arbitrarily far from the relay. It is easy to convert 
transmissivity t to distance d in optical fibre, by considering the standard loss rate of 0.2dB/km. 



Figure 2. Key-distribution via an ideal local relay. This is locally in Alice’s lab and it is assumed to work perfectly (unit 
quantum efficiency). By contrast, Bob’s link has transmissivity r < 1 corresponding to some distance d in standard 
optical fibre. Bob’s channel can also be affected by thermal/excess noise. 


In the scenario of Fig. |21 Bob can be very far from the relay also in the presence of non-zero excess noise 
s ^ 0, with potential distances beyond 100 km of simulated fibre. This can be seen from the numerical results 
shown in Fig. |3l where the solid line represents the case of a pure-loss attack (e = 0), while the dashed curve 
corresponds to an attack with non-zero excess noise, in particular e = 0.02. We can see the robustness of the 
key rate with respect to the excess noise. 

This theoretical analysis is also confirmed by a proof-of-principle experiment where we have realized the local 
ideal relay by suitably re-scaling the loss in Alice’s link in the post-processing of the data. We have reproduced the 
extreme asymmetric configuration of Fig. |21 with variable Bob’s transmissivity r, down to 4 x 10“'* corresponding 





















to about 170kin in standard optical fibre. For every experimental point, we have evaluated the key rate R 
assuming ideal reconcilation efficiency ^ = 1. Experimental results are plotted in Fig. [3] and compared with the 
theoretical predictions, with excellent agreement. The extrapolated experimental rate approaches the theoretical 
limit of the pure-loss attack. Due to imperfections, we have an excess noise e < 0.02. Note that we can potentially 
reach R ~ 10“^ secret bits per relay use over a link with 34dB loss, equivalent to 170km of optical fibre. 



Distance (km) 

Figure 3. Secret-key rate R versus Bob’s distance d from the relay. Experimental points refer to ideal reconciliation = 1, 
red circles) and realistic reconciliation ~ 0.97, blue squares). For comparison, we also plot the theoretical rates for a 
pure-loss attack (solid line) and a Gaussian attack with excess noise e = 0.02 (dashed line). 

Note that the current reconciliation procedures for CV protocols do not have unit efficiency (indeed this is 
one of the main factors limiting the distance of CV-QKD). By taking this limitation into accouniPSI (C 0.97), 
we can still reach remarkably high rates over distances well beyond the typical connection lengths of a network. 
As we can see from Fig. [3l one can potentially achieve R ~ 10“^ secret bits per relay use over a link with lOdB 
loss, equivalent to 50km of optical fibre. 


4. CONCLUSION 

In this work, we have explored the maximal performances in terms of rates and distances achievable by CV-MDI- 
QKD with coherent states. We have considered the extreme configuration where the relay is in Alice’s lab and 
the Bell detection is ideally performed. An important feature of this protocol is the simplicity of the relay, which 
does not possess any quantum source but just performs a standard optical measurement, with all the heavy 
procedures of data post-processing left to the end-users, fulfilling the idea behind the end-to-end principle.!^ CV 
Bell detection involves highly efficient photodetectors plus linear optics, whereas the discrete-variable version of 
this measurement needs nonlinear elements to operate deterministically. This feature combined with the use of 
coherent states makes the scheme very attractive, guaranteeing both cheap implementation and extremely high 
rates. 

Our study also shows how improvements in the classical reconciliation techniques (from ^ ~ 0.97 to ^ = 
1 ) have a dramatic impact on the performances of the protocol, which means that the development of more 
efficient classical codes for error correction and privacy amplification is a central task in CV-QKD. Finally, 
future investigations could involve the explicit security analysis of mixed technology environments where some 
of the connections are established at low frequencies (infrared or microwave) where thermal effects become 
important ISlEll 
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